The Hack Income Tax Breach: 10,897 Passwords Leaked in Plaintext

Hack Income Tax Data Breach: What HEROIC Analysts Found

HEROIC analysts have identified a data breach tied to Hack Income Tax, a US-based tax preparation platform, originally dated August 26, 2018. The incident exposed 10,897 unique records containing email addresses and plaintext passwords. The stolen data was later posted on a well-known hacking forum, where it became freely accessible to anyone looking to exploit it.

Why This Is Dangerous

Because the passwords in this breach were stored and leaked in plaintext, no cracking or decryption is required to use them. Anyone who downloads this dataset can attempt to log directly into the affected email accounts, and into any other account where the same password was reused. For a platform tied to tax preparation, that risk extends to financial accounts and personal identity information that may be linked to the same login.

What Was Exposed in the Hack Income Tax Breach

• Email addresses
• Plaintext passwords

Why This Matters for Hack Income Tax Users

Plaintext password exposures are especially valuable to attackers because they remove the biggest obstacle to abuse: password cracking. With a working email and password pair in hand, criminals can attempt credential stuffing across banking sites, email providers, and other tax or financial platforms, hoping the same login was reused. A successful match can lead to account takeover, unauthorized tax filings, or full identity theft, particularly given the financial nature of the original platform.

How Combolist and Database Breaches Like This Work

This incident combines two common breach patterns. A database breach occurs when attackers gain direct access to a company's user records, often through a vulnerable web application or unsecured server, and copy the data wholesale. That stolen data is then frequently repackaged into a combolist, a simple file pairing usernames or emails with passwords, formatted specifically so other criminals can feed it into automated login tools. Combolists like this one are traded and reused for years after the original breach, which is why old incidents like this can still pose a current risk.

Check If You Are Affected by the Hack Income Tax Breach

If you ever created an account with Hack Income Tax, or if you tend to reuse passwords across sites, it is worth checking whether your information appears in this or other breaches. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to show you where your email and passwords have been exposed, so you can change reused passwords before someone else uses them first.